StrikeShark Pillager/Searchall LSASS and NTDS Credential Dumping

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects the execution of known credential dumping tools and techniques on Windows systems. This includes targeting LSASS process memory using procdump or rundll32 with comsvcs.dll, and attempts to extract NTDS.dit via ntdsutil, vssadmin, or diskshadow.